Skip to content
eastbaycyber

CVE-2026-14282: Unauthenticated arbitrary file upload in rtCamp GoDAM

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-23
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical unauthenticated file upload flaw in GoDAM for WordPress. - Affects versions up to and including 1.12.2; upgrade immediately. - No verified active exploitation or public PoC confirmed, but risk is urgent.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-14282
CVSS 9.8 (Critical)
Attack vector Network
Privileges required None
Patch available Yes, a newer release is available; exact first fixed version not confirmed from retrieved primary sources

This CVE affects the GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin by rtCamp. The National Vulnerability Database describes it as an arbitrary file upload issue that can be reached through a public form-processing path, making it particularly dangerous on internet-facing WordPress sites.

For defenders, the quick takeaway is straightforward: if you run GoDAM version 1.12.2 or earlier, you should treat the instance as exposed until proven otherwise. The official WordPress plugin page shows a current available version of 2.0.0, but the exact first patched version was not conclusively verified from a primary patch diff or advisory available in the retrieved source set.

What Is This Vulnerability?

CVE-2026-14282 is an unauthenticated arbitrary file upload vulnerability in the GoDAM WordPress plugin. According to the NVD description, the vulnerable code path is in the save_video_file() function, which is hooked into WPForms’ public wpforms_process_before_filter workflow. That matters because this path may be reachable through user-submitted form traffic rather than a privileged administrative interface.

The core problem is insufficient file type validation. Instead of relying on WordPress’ safer upload handling flow, the vulnerable code reportedly trusts the attacker-controlled multipart Content-Type header, preserves the original filename through wp_unique_filename(), and then moves the upload into a web-served directory using $wp_filesystem->move(). In practice, this can bypass WordPress protections normally enforced by wp_handle_upload(), including MIME and extension allowlist checks.

That root cause is more serious than a generic upload bug because it combines three high-risk traits: it is network reachable, it appears to be unauthenticated, and it can place attacker-controlled content in a web-accessible location. On PHP-enabled WordPress stacks, that can create a path to remote code execution if the uploaded file is executable or can otherwise be interpreted by the server.

Even where direct code execution is blocked, arbitrary uploads can still enable site compromise through stored malware, phishing content, backdoors, or second-stage payload delivery. For SMB defenders, this should be handled like a likely web-shell-enabling vulnerability until they confirm otherwise in their own environment.

AnalystImpact · assess the risk

Who Is Affected?

The NVD description states that the vulnerability affects the GoDAM plugin in “versions up to, and including, 1.12.2.” That means every known release from the start of the vulnerable branch through 1.12.2 should be assumed vulnerable unless a site owner has independent evidence of a custom patch.

The affected product is:

  • GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more
  • Vendor/author: rtCamp
  • Platform: WordPress plugin

The official WordPress.org plugin page shows that the currently distributed version is 2.0.0. However, based on the retrieved primary-source material, the exact first fixed version number was not confirmed. That distinction matters for asset owners maintaining internal mirrors or staging channels. If you are on 1.12.2 or earlier, you should consider the plugin affected. If you are on a later release but not on 2.0.0, verify the changelog or source before assuming you are safe.

There is also an operational nuance here: because the vulnerable path is tied to WPForms processing, the practical attack surface may be greatest on sites where GoDAM and WPForms are both installed and where relevant form handlers are exposed to unauthenticated visitors. In the absence of a vendor advisory that narrows those prerequisites further, defenders should assume any public-facing site running the affected plugin versions may be at risk.

Technical Notes

To quickly identify potentially affected WordPress instances from a shell:

wp plugin list --format=table | grep -i godam

To inspect the installed plugin version directly:

grep -E "Version:" wp-content/plugins/godam/godam.php

If you manage multiple sites centrally, look for the plugin directory across web roots:

find /var/www -type d -path "*/wp-content/plugins/godam" 2>/dev/null

CVSS Score Breakdown

The published CVSS base score is 9.8, which places CVE-2026-14282 in the Critical range. Although the exact CVSS vector string was not returned in the available NVD tool output used for this article, the score itself aligns with what defenders would expect from a flaw that is remotely reachable, requires no authentication, and can plausibly result in full application compromise.

A score this high usually reflects a combination like the following: network attack vector, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. That fits the practical risk of an arbitrary upload vulnerability where a malicious file may be placed into a web-served location and then executed or leveraged for follow-on compromise.

For practitioners, the important point is not just the number. A 9.8 on a WordPress plugin issue often means the bug is easy to reach at scale and can be weaponized quickly once exploit details circulate. Even without a confirmed public exploit, defenders should prioritize remediation similarly to an edge-service RCE because shared hosting, unmanaged PHP settings, and plugin-heavy WordPress deployments tend to reduce the number of mitigating controls in place.

Because the exact vector string was not available in the retrieved source material, teams should avoid assuming any hidden limiting factor. In other words, unless you have verified environment-specific controls that prevent abuse, handle this as internet-exploitable with potential full site compromise.

Exploitation Status

At the time of writing, there is no verified evidence from the retrieved primary sources that CVE-2026-14282 is actively exploited in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, which is one useful indicator, though not proof of safety. Absence from KEV should not be interpreted as low risk.

There is also no confirmed public proof of concept (PoC) in the collected source set. The research note explicitly states that no clearly relevant public exploit repository was verified for this CVE, and no primary-source advisory or write-up confirming a PoC was identified. That means defenders should state the current status carefully:

  • Public PoC: not verified from retrieved sources
  • Active exploitation in the wild: not verified from retrieved sources
  • CISA KEV status: not listed

That said, this is still a high-priority issue. Unauthenticated file upload bugs in WordPress ecosystems are routinely attractive to opportunistic attackers because exploitation can be automated and monetized quickly. Once a vulnerable code path is understood, exploitation often does not require deep target-specific customization. In practical terms, the lack of a verified PoC today should buy defenders time for patching and hunting, not justify delay.

ResponderRunbook · act now

How to Detect It

Detection should focus on two parallel questions: was the vulnerable code path exposed? and did an attacker successfully place files into web-accessible directories? Because the vulnerable behavior reportedly trusts multipart Content-Type and preserves attacker-controlled filenames, defenders should review form submission logs, web server access logs, WAF telemetry, and file integrity changes under WordPress upload and plugin-related directories.

Start by looking for suspicious POST requests associated with WPForms processing around the time the plugin was internet-exposed. Then pivot to newly created files with risky extensions such as .php, .phtml, .phar, or double extensions like .php.jpg. If your environment normally disallows executable content in upload paths, any such file should be treated as a probable compromise indicator until triaged.

You should also inspect directories that are both web-served and writable by the web application. While the NVD description does not provide the exact upload destination path, it does say the file is moved into a web-served directory. That is enough to justify a broad hunt under wp-content/uploads/, plugin-managed media folders, and any custom upload locations used by the site.

Technical Notes

Example web log patterns to review for suspicious multipart uploads:

grep -R 'POST .*wpforms' /var/log/nginx/access.log* /var/log/apache2/*access* 2>/dev/null
grep -R 'multipart/form-data' /var/log/nginx/access.log* /var/log/apache2/*access* 2>/dev/null

Look for suspicious file creation in common WordPress content paths:

find /var/www/html/wp-content -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -printf "%TY-%Tm-%Td %TT %p\n" 2>/dev/null | sort

Example Sigma-style hunting logic for web logs:

title: Suspicious WPForms upload activity with executable extension
logsource:
  category: webserver
detection:
  selection_post:
    cs-method: POST
  selection_uri:
    cs-uri-stem|contains:
      - "wpforms"
  selection_exec_ext:
    cs-uri-query|contains:
      - ".php"
      - ".phtml"
      - ".phar"
  condition: selection_post and selection_uri and selection_exec_ext
level: high

Example Splunk query to hunt suspicious uploads and subsequent execution attempts:

index=web sourcetype IN (apache:access, nginx:access)
("wpforms" AND "POST") OR (".php" OR ".phtml" OR ".phar")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, host, uri, user_agent, status
| sort - lastSeen

If no definitive logging exists, defenders should assume attempted exploitation may not be visible and rely more heavily on file system inspection, malware scanning, and review of recently modified content.

Mitigation and Patching

The clearest mitigation from the currently available evidence is to upgrade off all vulnerable versions immediately. The NVD states that versions up to and including 1.12.2 are vulnerable. The official plugin page shows 2.0.0 as the current available release. Because the exact first fixed version could not be confirmed from retrievable primary patch material, the safest recommendation is to upgrade to 2.0.0, not merely to an unspecified later 1.x release.

If immediate upgrade is not possible, reduce exposure by disabling the plugin or removing public access to the vulnerable workflow. Since the vulnerable function is described as being hooked into WPForms’ public wpforms_process_before_filter, temporarily restricting public form submission paths, disabling the affected form integration, or taking the plugin offline can meaningfully reduce risk. However, these are temporary measures, not substitutes for patching and post-exploitation review.

Defenders should also harden execution behavior in upload directories where feasible. On Apache, that can include disabling PHP execution in upload paths. On Nginx with PHP-FPM, ensure upload locations are not mapped to executable PHP handlers. These controls will not fix the vulnerability, but they can reduce the blast radius if a malicious file was uploaded.

Technical Notes

Upgrade with WP-CLI:

wp plugin update godam --version=2.0.0

If you only want the latest available release:

wp plugin update godam

Temporary emergency disable:

wp plugin deactivate godam

Basic Apache hardening example for uploads:

<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8
</Directory>

Basic Nginx block example to prevent PHP execution from uploads:

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
}

After patching, hunt for suspicious files and compare timestamps around exposure windows:

find /var/www/html/wp-content -type f -mtime -30 -printf "%TY-%Tm-%Td %TT %p\n" | sort

If compromise is suspected, preserve evidence before cleanup, rotate WordPress admin credentials, review plugin and theme integrity, and consider the host fully exposed until forensic review is complete.

References

The primary technical description for this vulnerability comes from the NVD record for CVE-2026-14282, which identifies the flaw as an arbitrary file upload issue in GoDAM, explains the vulnerable save_video_file() path, and states that versions up to and including 1.12.2 are affected.

The official product identity and currently distributed plugin version were verified against the WordPress.org plugin page for GoDAM by rtCamp. That page shows the plugin name, author, and current release information used in this article. However, a vendor security advisory or directly retrievable patch diff confirming the exact first fixed version was not available in the retrieved source set, so that point remains explicitly unconfirmed.

For further reading on related topics, check out our articles on best identity and access management platforms and what is the cyber kill chain.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-23

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.